Cyber Resilience Act
All 6 isidaten articles on Cyber Resilience Act, newest first.
Whoever finds a flaw needs an address
A security researcher finds a vulnerability in your product and looks for a contact. She finds the legal notice, info@ and a chatbot. From December 2027, the Cyber Resilience Act requires a contact address for vulnerability reports and a policy on coordinated disclosure. The security.txt per RFC 9116 is where researchers look first, and it goes stale silently.
Read more
The second bill of materials
By now everyone knows the software bill of materials; the Cyber Resilience Act requires it. Hardly anyone knows the second one: which cryptographic algorithms run where. Since 2024 there has been a format for it, and in isidaten three ways to fill it.
Read more
Grandfathering stops at reporting
Everyone knows 11 December 2027 for the Cyber Resilience Act. The date that matters is 11 September 2026: that is the day the manufacturers' reporting obligations begin. And unlike the rest of the regulation, they come with no grandfathering.
Read more
Old does not mean exempt
The Cyber Resilience Act applies from December 2027, and existing products are spared until then. For the reporting duty starting 11 September, exactly that does not hold: a separate paragraph explicitly withdraws the exemption.
Read more
Non-binding, but machine-readable
The BSI has published TR-03183-1 in version 1.0.0: an entry aid into the Cyber Resilience Act, without presumption of conformity. The most interesting part sits at the margin: the selection of measures also comes in the machine-readable OSCAL format, though only on request.
Read more
Exploitable is not exploited
On 11 September the reporting duty under the Cyber Resilience Act takes effect, two years before the regulation applies in full. 24 hours from awareness. But awareness of what exactly? The regulation distinguishes three kinds of vulnerability, and only the third triggers a report.
Read more